Article

    Connect Amazon Bedrock with an IAM role

    6 min read
    Last updated 4 hours ago

    Connect Unthread to Amazon Bedrock in your AWS account using an IAM role. You keep control of the role and its permissions; you do not need to give Unthread an AWS access key or Bedrock API key. Unthread assumes your role to obtain temporary credentials for model requests.

    Before you start

    • An Unthread workspace administrator must configure the connection.
    • An AWS administrator must be able to create an IAM role, edit its trust policy, and attach permissions in the account that will run Bedrock.
    • Choose a Bedrock model or inference profile and a supported AWS region. Your account must have the required model access, subscriptions or provider approvals, and available quota.
    • Your AWS account owns inference usage and charges. This integration supports commercial AWS regions and public AWS endpoints; GovCloud, China, and private-only endpoints are not supported.

    1. Copy your workspace’s AWS setup values

    1. In Unthread, open Workspace Settings → Artificial Intelligence → AI Model.
    2. Choose Amazon Bedrock as the provider and IAM role as the authentication method.
    3. Copy the displayed Unthread AWS principal, External ID, and Customer role trust policy.

    If IAM role is unavailable or the page says IAM authentication is not configured by Unthread, contact Unthread support before continuing.

    For production, the Unthread AWS principal is arn:aws:iam::186015733989:user/unthread-bedrock. The external ID is unique to your Unthread workspace; find it in the External ID field on this AI Model page and copy it exactly into the trust policy. There is no single external ID shared by all customers. Staging uses a different principal and external ID, so always use the values shown in the environment you are connecting.

    2. Create the role in your AWS account

    1. Open the AWS IAM console and go to Roles → Create role.
    2. Select Custom trust policy and paste the complete trust policy copied from Unthread.
    3. Continue through the permissions step; you will attach a scoped policy in the next section.
    4. Name the role, for example UnthreadBedrock, review it, and create it.
    5. Copy the role’s ARN from its summary. It should look like arn:aws:iam::123456789012:role/UnthreadBedrock.
    {
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::186015733989:user/unthread-bedrock" },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": { "sts:ExternalId": "<EXTERNAL_ID_FROM_UNTHREAD>" }
    }
  }]
}

    Keep the exact principal and external-ID condition. Do not add another statement allowing Unthread to assume this role without that condition. Unthread checks that missing and incorrect external IDs are denied. See AWS guidance on third-party access and external IDs.

    Keep the role’s maximum session duration at one hour or longer. Unthread requests one-hour sessions and refreshes credentials automatically.

    3. Allow your selected Bedrock models

    On the role’s Permissions tab, choose Add permissions → Create inline policy → JSON. Start with the following policy, replace the resource placeholder, and save it with a name such as InvokeSelectedBedrockModels.

    {
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "bedrock:InvokeModel",
      "bedrock:InvokeModelWithResponseStream"
    ],
    "Resource": ["<BEDROCK_MODEL_OR_PROFILE_RESOURCE_ARN>"]
  }]
}

    For a directly invoked foundation model, use its actual resource ARN, in the form arn:aws:bedrock:REGION::foundation-model/MODEL_ID. The account field is empty for foundation models. Confirm that the model supports direct invocation in your selected region.

    For an inference profile, include the profile ARN and the underlying foundation-model ARNs for every region required by that profile. A policy containing only the profile ARN is insufficient. Organization policies and permission boundaries must also allow the required regions and invocation actions. Follow AWS’s inference-profile permissions guide for your chosen profile.

    Grant only the resources you intend to use. AdministratorAccess and Bedrock management permissions are not needed for this connection.

    4. Save the connection in Unthread

    1. Return to the AI Model configuration in Unthread.
    2. Enter the Customer role ARN from step 2.
    3. Enter the AWS region where requests should be sent, such as us-east-1.
    4. Enter the exact Bedrock model or inference-profile identifier. If your Unthread configuration uses the Anthropic route, retain the anthropic/ prefix before the AWS identifier. The prefix belongs only in Unthread’s model field, not in AWS IAM resource ARNs.
    5. Save the configuration.

    Role access verified means Unthread successfully assumed the role with your external ID and confirmed that missing and incorrect IDs were denied. Saving does not invoke the model or verify model permissions. If validation fails, your existing connection is preserved.

    5. Test a real AI request

    Run an AI action in Unthread that uses this configuration and confirm you receive a model response. Test streaming where your workflow uses it. If your workspace has model overrides for particular AI features, test those features too.

    Troubleshooting

    • Could not verify AWS role access: check the role ARN, exact principal, and external ID. Confirm you used values from the correct workspace/environment and that organization policies or permission boundaries do not deny role assumption.
    • The role must reject missing and incorrect external IDs: remove or restrict any trust-policy statement that lets Unthread assume the role without the exact external ID.
    • Role access verified, but AI requests fail: check model access, the selected region and identifier, invocation permissions, profile destination regions, and available quota. Role trust and model access are separate checks.
    • Model requires an inference profile: use a supported profile identifier and add the profile plus its underlying model resources to the role’s permissions.

    When contacting support, share the error message, AWS region, model/profile identifier, and approximate request time. Never send AWS secret keys or session tokens.

    Remove access

    To stop new role sessions, remove Unthread from the role’s trust policy. Existing temporary sessions may remain valid until they expire. To invalidate existing sessions, follow AWS’s role-session revocation procedure. Unthread does not automatically fall back to an API key when IAM authentication fails.